Virus Name: TalkingHeads
V Status: Viron
Discovered: February, 1993.
Symptoms: .COM file corruption; programs fail to function; message;
README.COM file created
Eff Length: 519 Bytes OW
Type Code: ONCK - Overwriting Non-Resident .COM Infector
Detection Method: NAV, ViruScan, F-Prot, AVTK, Sweep, IBMAV,
NAVDX, VAlert, PCScan, ChAV,
NShld, Sweep/N, NAV/N, AVTK/N, NProt, IBMAV/N, Innoc,
Removal Instructions: Delete infected files
The TalkingHeads virus was submitted in February, 1993. Its origin
or point of isolation is unknown. TalkingHeads is a non-resident,
direct action infector of .COM programs, including COMMAND.COM. It
permanently corrupts the .COM programs it infects.
When a program infected with the TalkingHeads virus is executed, this
virus will infect two .COM programs located in the current directory.
Also at this time, the virus will create a 519 byte file named
README.COM in the current directory, as create a 519 byte CHKDSK.COM
file in the C:\DOS directory if the file doesn't already exist.
Programs infected with the TalkingHeads virus will have the first
519 bytes of the host program overwritten by the virus' code. There
will be no increase in file size unless the file was originally
smaller than 519 bytes in length, in which case it will become 519
bytes in length. The program's date and time in the DOS disk
directory listing will not be altered. The following text strings
can be found unencrypted within the viral code in all infected
The TalkingHeads virus may display the following message when an
infected program is executed on Fridays between 11:00 and 11:59:
"This ain't no disco..."
The virus doesn't always experience this behaviour. The above
message is encrypted within the virus.